* [PATCH net 0/2] cxgb4: fix memory vulnerabilities @ 2023-01-16 15:20 Maksim Davydov 2023-01-16 15:20 ` [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access Maksim Davydov 2023-01-16 15:21 ` [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL Maksim Davydov 0 siblings, 2 replies; 7+ messages in thread From: Maksim Davydov @ 2023-01-16 15:20 UTC (permalink / raw) To: rajur Cc: davydov-max, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel This series fixes potential vulnerabilities in cxgb4 via additional checks to make sure that we don't corrupt memory. Maksim Davydov (2): net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access net/ethernet/chelsio: t4_handle_fw_rpl fix NULL drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 3 ++- 2 files changed, 6 insertions(+), 2 deletions(-) -- 2.25.1 ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access 2023-01-16 15:20 [PATCH net 0/2] cxgb4: fix memory vulnerabilities Maksim Davydov @ 2023-01-16 15:20 ` Maksim Davydov 2023-01-17 9:21 ` Leon Romanovsky 2023-01-16 15:21 ` [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL Maksim Davydov 1 sibling, 1 reply; 7+ messages in thread From: Maksim Davydov @ 2023-01-16 15:20 UTC (permalink / raw) To: rajur Cc: davydov-max, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed additional check to make sure that this code doesn't have access to tsa. Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops") Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> --- drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c index 7d5204834ee2..3aa65f0f335e 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc, return; } - *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; + /* Valid values are: 0-7 */ + if (*pgid <= 7) + *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; + *up_tc_map = (1 << tc); /* prio_type is link strict */ -- 2.25.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access 2023-01-16 15:20 ` [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access Maksim Davydov @ 2023-01-17 9:21 ` Leon Romanovsky 2023-01-18 8:29 ` Maksim Davydov 0 siblings, 1 reply; 7+ messages in thread From: Leon Romanovsky @ 2023-01-17 9:21 UTC (permalink / raw) To: Maksim Davydov Cc: rajur, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote: > *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID > are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed > additional check to make sure that this code doesn't have access to tsa. > > Found by Linux Verification Center (linuxtesting.org) with the SVACE > static analysis tool. > > Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops") > Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> > --- > drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++- > 1 file changed, 4 insertions(+), 1 deletion(-) > > diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c > index 7d5204834ee2..3aa65f0f335e 100644 > --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c > +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c > @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc, > return; > } > > - *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; > + /* Valid values are: 0-7 */ How do you see it? There are lines below that assume something different. 477 /* prio_type is link strict */ 478 if (*pgid != 0xF) 479 *prio_type = 0x2; > + if (*pgid <= 7) > + *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; Why do you think that it is valid simply do not set *bw_per? Thanks ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access 2023-01-17 9:21 ` Leon Romanovsky @ 2023-01-18 8:29 ` Maksim Davydov 2023-05-05 9:32 ` Maksim Davydov 0 siblings, 1 reply; 7+ messages in thread From: Maksim Davydov @ 2023-01-18 8:29 UTC (permalink / raw) To: Leon Romanovsky Cc: rajur, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel On 1/17/23 12:21, Leon Romanovsky wrote: > On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote: >> *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID >> are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed >> additional check to make sure that this code doesn't have access to tsa. >> >> Found by Linux Verification Center (linuxtesting.org) with the SVACE >> static analysis tool. >> >> Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops") >> Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> >> --- >> drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++- >> 1 file changed, 4 insertions(+), 1 deletion(-) >> >> diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >> index 7d5204834ee2..3aa65f0f335e 100644 >> --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >> +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >> @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device *dev, int tc, >> return; >> } >> >> - *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; >> + /* Valid values are: 0-7 */ > How do you see it? > > There are lines below that assume something different. > 477 /* prio_type is link strict */ > 478 if (*pgid != 0xF) > 479 *prio_type = 0x2; > But if *pgid == 0xF we get value for *bw_per from pgrate.tsa, it seems not correct Thanks for reviewing, Maksim Davydov >> + if (*pgid <= 7) >> + *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; > Why do you think that it is valid simply do not set *bw_per? > > Thanks ^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access 2023-01-18 8:29 ` Maksim Davydov @ 2023-05-05 9:32 ` Maksim Davydov 0 siblings, 0 replies; 7+ messages in thread From: Maksim Davydov @ 2023-05-05 9:32 UTC (permalink / raw) To: Leon Romanovsky Cc: rajur, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel Ping To summarize: *pgid can be 0xF, but valid values are 0-7. Whether *bw_per is set or not set inside if-block, it will have valid value (it was set to zero before) On 1/18/23 11:29, Maksim Davydov wrote: > > On 1/17/23 12:21, Leon Romanovsky wrote: >> On Mon, Jan 16, 2023 at 06:20:59PM +0300, Maksim Davydov wrote: >>> *pgid can be in range 0 to 0xF (bitmask 0xF) but valid values for PGID >>> are between 0 and 7. Also the size of pgrate is 8. Thus, we are needed >>> additional check to make sure that this code doesn't have access to >>> tsa. >>> >>> Found by Linux Verification Center (linuxtesting.org) with the SVACE >>> static analysis tool. >>> >>> Fixes: 76bcb31efc06 ("cxgb4 : Add DCBx support codebase and dcbnl_ops") >>> Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> >>> --- >>> drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c | 5 ++++- >>> 1 file changed, 4 insertions(+), 1 deletion(-) >>> >>> diff --git a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >>> b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >>> index 7d5204834ee2..3aa65f0f335e 100644 >>> --- a/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >>> +++ b/drivers/net/ethernet/chelsio/cxgb4/cxgb4_dcb.c >>> @@ -471,7 +471,10 @@ static void cxgb4_getpgtccfg(struct net_device >>> *dev, int tc, >>> return; >>> } >>> - *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; >>> + /* Valid values are: 0-7 */ >> How do you see it? >> >> There are lines below that assume something different. >> 477 /* prio_type is link strict */ >> 478 if (*pgid != 0xF) >> 479 *prio_type = 0x2; >> > But if *pgid == 0xF we get value for *bw_per from pgrate.tsa, it seems > not correct > > Thanks for reviewing, > Maksim Davydov >>> + if (*pgid <= 7) >>> + *bw_per = pcmd.u.dcb.pgrate.pgrate[*pgid]; >> Why do you think that it is valid simply do not set *bw_per? >> >> Thanks -- Best regards, Maksim Davydov ^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL 2023-01-16 15:20 [PATCH net 0/2] cxgb4: fix memory vulnerabilities Maksim Davydov 2023-01-16 15:20 ` [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access Maksim Davydov @ 2023-01-16 15:21 ` Maksim Davydov 2023-01-17 11:05 ` Leon Romanovsky 1 sibling, 1 reply; 7+ messages in thread From: Maksim Davydov @ 2023-01-16 15:21 UTC (permalink / raw) To: rajur Cc: davydov-max, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel After t4_hw.c:t4_prep_adapter() that is called in cxgb4_main.c:init_one() adapter has it least 1 port for debug. Thus, for_each_port() usually has at least 1 iteration, but this function can be called with wrong configured adapter Found by Linux Verification Center (linuxtesting.org) with the SVACE static analysis tool. Fixes: 23853a0a9a76 ("cxgb4: Don't assume FW_PORT_CMD reply is always port info msg") Signed-off-by: Maksim Davydov <davydov-max@yandex-team.ru> --- drivers/net/ethernet/chelsio/cxgb4/t4_hw.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c index 8d719f82854a..2f7b49473f52 100644 --- a/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c +++ b/drivers/net/ethernet/chelsio/cxgb4/t4_hw.c @@ -8864,7 +8864,8 @@ int t4_handle_fw_rpl(struct adapter *adap, const __be64 *rpl) break; } - t4_handle_get_port_info(pi, rpl); + if (pi) + t4_handle_get_port_info(pi, rpl); } else { dev_warn(adap->pdev_dev, "Unknown firmware reply %d\n", opcode); -- 2.25.1 ^ permalink raw reply related [flat|nested] 7+ messages in thread
* Re: [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL 2023-01-16 15:21 ` [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL Maksim Davydov @ 2023-01-17 11:05 ` Leon Romanovsky 0 siblings, 0 replies; 7+ messages in thread From: Leon Romanovsky @ 2023-01-17 11:05 UTC (permalink / raw) To: Maksim Davydov Cc: rajur, davem, edumazet, kuba, pabeni, anish, hariprasad, netdev, linux-kernel On Mon, Jan 16, 2023 at 06:21:00PM +0300, Maksim Davydov wrote: > After t4_hw.c:t4_prep_adapter() that is called in cxgb4_main.c:init_one() > adapter has it least 1 port for debug. IMHO it is wrong to keep this interface and the logic for this debug code should be deleted. Thanks ^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2023-05-05 9:35 UTC | newest] Thread overview: 7+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2023-01-16 15:20 [PATCH net 0/2] cxgb4: fix memory vulnerabilities Maksim Davydov 2023-01-16 15:20 ` [PATCH net 1/2] net/ethernet/chelsio: fix cxgb4_getpgtccfg wrong memory access Maksim Davydov 2023-01-17 9:21 ` Leon Romanovsky 2023-01-18 8:29 ` Maksim Davydov 2023-05-05 9:32 ` Maksim Davydov 2023-01-16 15:21 ` [PATCH net 2/2] net/ethernet/chelsio: t4_handle_fw_rpl fix NULL Maksim Davydov 2023-01-17 11:05 ` Leon Romanovsky
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).